CVE-2025-63260

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-63260
SyncFusion 30.1.37 is vulnerable to Cross Site Scripting (XSS) via the Document-Editor reply to comment field and Chat-UI Chat message.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
http://syncfusion.com Product
https://pentest-tools.com/PTT-2025-023-Multiple-Stored-XSS.pdf Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:syncfusion:syncfusion:30.1.37:*:*:*:*:*:*:*
History

14 Apr 2026, 19:26

Type Values Removed Values Added
CPE cpe:2.3:a:syncfusion:syncfusion:30.1.37:*:*:*:*:*:*:*
References () http://syncfusion.com - () http://syncfusion.com - Product
References () https://pentest-tools.com/PTT-2025-023-Multiple-Stored-XSS.pdf - () https://pentest-tools.com/PTT-2025-023-Multiple-Stored-XSS.pdf - Exploit, Third Party Advisory
Summary
  • (es) SyncFusion 30.1.37 es vulnerable a Cross Site Scripting (XSS) a través del campo de respuesta a comentarios del Editor de Documentos y el mensaje de chat de la interfaz de usuario de chat.
First Time Syncfusion
Syncfusion syncfusion

23 Mar 2026, 15:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.4
CWE CWE-79

20 Mar 2026, 20:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-20 20:16

Updated : 2026-04-14 19:26

NVD link : CVE-2025-63260

Mitre link : CVE-2025-63260

CVE.ORG link : CVE-2025-63260

JSON object : View

Products Affected

syncfusion

  • syncfusion
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')